JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 80.78.180.29

80.78.180.29 was found in our database!

This IP was reported 75 times. Confidence of Abuse is 100%: ?

100%

ISP	TELTA-Servers
Usage Type	Fixed Line ISP
ASN	AS21032
Domain Name	telta.de
Country	🇩🇪 Germany
City	Eberswalde, Brandenburg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 80.78.180.29

Whois 80.78.180.29

IP Abuse Reports for 80.78.180.29:

This IP address has been reported a total of 75 times from 66 distinct sources. 80.78.180.29 was first reported on July 20th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-21 06:00:00 (1 day ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇦🇹 urnilxfgbez	2026-07-20 22:45:00 (1 day ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-07-20 09:00:49 (2 days ago)	Brute-force attack detected. IP banned after multiple failed login attempts.	Brute-Force SSH
🇺🇸 infra-monitor	2026-07-20 07:00:06 (2 days ago)	Automated ban via infra-monitor: webshell-high-confidence, php-obscure-path-backdoor, crowdsecurity/ ... show more Automated ban via infra-monitor: webshell-high-confidence, php-obscure-path-backdoor, crowdsecurity/CVE-2017-9841, +1 more show less	Port Scan Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 06:46:56 (2 days ago)	(mod_security) mod_security (id:218420) triggered by 80.78.180.29 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 80.78.180.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 02:46:51.086943 2026] [security2:error] [pid 23001:tid 23001] [client 80.78.180.29:54972] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.226:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.226"] [uri "/hello.world"] [unique_id "al3EW0ierbZqrfwAFfSpmAAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 security.rdmc.fr	2026-07-20 06:44:23 (2 days ago)	Port Scan Attack proto:TCP src:64450 dst:23	Port Scan
🇩🇪 femboy.cat	2026-07-20 06:28:12 (2 days ago)	Port scan to tcp/23 from 80.78.180.29	Brute-Force
🇵🇱 mkey	2026-07-20 06:20:01 (2 days ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS ... show more Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=22 \| HITS=2 \| IPSET=ADD \| FIRST=2026-07-20 08:16:55 \| LAST=2026-07-20 08:16:55. Last seen 2026-07-20 08:16:55. show less	Port Scan
Anonymous	2026-07-20 06:15:16 (2 days ago)	Multiple web server 400 error codes from same source ip	Web App Attack
🇹🇭 MWA SOC	2026-07-20 06:15:13 (2 days ago)		Hacking
🇩🇪 nicosqc	2026-07-20 06:10:52 (2 days ago)	Invalid user admin from 80.78.180.29 port 34962	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-07-20 06:02:32 (2 days ago)	(mod_security) mod_security (id:218420) triggered by 80.78.180.29 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 80.78.180.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 02:02:26.750845 2026] [security2:error] [pid 17631:tid 17631] [client 80.78.180.29:48192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.151.37:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.151.37"] [uri "/hello.world"] [unique_id "al258s4Fwuwqavd7LgK3hgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 venus.launch.bz	2026-07-20 06:01:11 (2 days ago)	(wpscan) WordPress probe detected from 80.78.180.29 (DE/Germany/-)	Hacking
🇮🇩 Burayot	2026-07-20 05:53:06 (2 days ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 80.78.180.29 (DE/Germany/-): 2 in th ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 80.78.180.29 (DE/Germany/-): 2 in the last 3600 secs show less	Web App Attack
🇪🇸 www.pk25.com	2026-07-20 05:51:15 (2 days ago)	2026-07-20T07:47:07.665383+02:00 servidor1 sshd-session[2832879]: Invalid user orangepi from 80.78.1 ... show more 2026-07-20T07:47:07.665383+02:00 servidor1 sshd-session[2832879]: Invalid user orangepi from 80.78.180.29 port 40540 2026-07-20T07:47:07.666753+02:00 servidor1 sshd-session[2832879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.180.29 2026-07-20T07:47:09.152469+02:00 servidor1 sshd-session[2832879]: Failed password for invalid user orangepi from 80.78.180.29 port 40540 ssh2 2026-07-20T07:49:09.997199+02:00 servidor1 sshd-session[2833421]: User root from 80.78.180.29 not allowed because not listed in AllowUsers 2026-07-20T07:49:10.002521+02:00 servidor1 sshd-session[2833421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.180.29 user=root 2026-07-20T07:49:11.758084+02:00 servidor1 sshd-session[2833421]: Failed password for invalid user root from 80.78.180.29 port 57932 ssh2 2026-07-20T07:51:14.454874+02:00 servidor1 sshd-session[2835683]: User root from 80.78.180.29 not allowed because not l ... show less	Brute-Force SSH

Showing 1 to 15 of 75 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.86

🇸🇬 118.201.199.153

🇨🇳 117.69.255.239

🇵🇰 111.68.98.152

🇫🇷 91.196.152.121

🇦🇿 37.114.144.151

🇰🇷 1.212.225.99

🇧🇷 206.42.8.243

🇧🇷 205.210.31.226

🇩🇪 167.94.146.40

🇨🇳 122.226.38.134

🇮🇳 117.247.47.233

🇨🇳 115.49.201.84

🇮🇩 114.8.234.90

🇹🇼 111.70.49.182

🇹🇭 106.0.165.219

🇮🇳 103.52.36.243

🇨🇦 85.217.149.60

🇬🇧 82.4.2.244

🇨🇿 78.24.15.92